@fun-xyz/fiat-contract 0.20.1 → 0.21.0

package/README.md

@@ -99,46 +99,61 @@ this package is [ENG-5268](https://linear.app/funxyz/issue/ENG-5268).
 
 A provider can run its own flow instead of the shared step machine. `POST /fiat/quote` still routes
 and prices. When the request's `handoffs` lists the winning provider, the response carries
-`handoff: { provider, terms }` and no transitions, and the client calls that provider's
-`POST /fiat/providers/{provider}/intent`. `terms` lists the `CHECKOUT` documents this login has not
-accepted at the current version; it is empty for a returning buyer. The schema refuses a handoff on
-any state but `QUOTE`, a handoff to a provider other than the response's own, a handoff that still
-offers transitions, and a `terms` entry that is not a unique `CHECKOUT` document.
+`handoff: { provider }` and no transitions. The client shows that provider's `CHECKOUT` documents
+from `PROVIDER_CHECKOUT_DOCUMENTS`, records them with `POST /fiat/terms` on Continue, and then calls
+`POST /fiat/providers/{provider}/intent`. The schema refuses a handoff on any state but `QUOTE`, a
+handoff to a provider other than the response's own, and a handoff that still offers transitions.
 
 **Terms (`./terms`).** Every provider records acceptances through the platform `POST /fiat/terms`
-(`FIAT_TERMS_ENDPOINT`), with an `Idempotency-Key`. A `TermsDocument` has an `id`, a `kind`
-(`FUN_TERMS`, `PROVIDER_TERMS`, `FUN_KYC_COLLECTION`, `PROVIDER_KYC_SHARING`), a `stage` (`CHECKOUT` or
+(`FIAT_TERMS_ENDPOINT`). A `TermsDocument` has an `id`, a `kind`
+(`PROVIDER_TERMS`, `FUN_KYC_COLLECTION`, `PROVIDER_KYC_SHARING`), a `stage` (`CHECKOUT` or
 `KYC`), an opaque `version` and `contentDigest`, and at least one `https` link. `FiatTermsRequest` is
 `{ provider, acceptances: [{ documentId, version, contentDigest, acceptedAt }] }`, each document at
 most once; `FiatTermsResponse` is `{ recorded }`, the recorded document ids. A fault is a
 `FiatTermsErrorBody`: the shared `errorCode`, `errorMsg` and `reqId`, plus `reason` (`STALE_TERMS`,
-`IN_PROGRESS`, `IDEMPOTENCY_KEY_REUSED`, `INVALID_REQUEST`, `RATE_LIMITED`, `PROVIDER_UNAVAILABLE`) and `recovery`.
+`IN_PROGRESS`, `INVALID_REQUEST`, `RATE_LIMITED`, `PROVIDER_UNAVAILABLE`) and `recovery`.
+
+The package publishes every document as a constant, so the client and the backend read the same
+text. `PROVIDER_CHECKOUT_DOCUMENTS` maps each provider to its current `CHECKOUT` documents.
+`FUN_KYC_CONSENT_DOCUMENTS` is Fun's KYC consent, one digest per `FunKycConsentLocale`.
+`PUBLISHED_TERMS_DOCUMENTS` is every version and locale ever published. Every published version
+stays valid: the backend refuses only an unknown version, a wrong digest, or an `acceptedAt` older
+than 5 minutes. A repeat of a version the login already holds writes nothing and returns the ids.
 
 **MoonPay (`./moonpay`).** One route, `MOONPAY_ENDPOINTS.intent`. A `MoonPayIntentRequest` is one of
 three kinds:
 
-| `kind` | Carries | `Idempotency-Key` |
+| `kind` | Carries | A repeat |
 | --- | --- | --- |
-| `observe` | `checkout`, and `credentials` (`customerId`, `accessToken`) once the SDK has them | ignored |
-| `kyc` | `checkout`, `credentials`, `values` keyed by field id (no form id) | required |
-| `order` | `orderId`, `transactionId` | required |
+| `observe` | `checkout`, and `credentials` (`customerId`, `accessToken`) once the SDK has them | writes nothing new |
+| `kyc` | `checkout`, `credentials`, `values` keyed by `KycFieldId` (no form id) | drops values MoonPay no longer asks for; a concurrent one gets `409 IN_PROGRESS` |
+| `order` | `orderId`, `transactionId` | returns the claimed order |
 
-A `MoonPayIntentResponse` says what the backend needs next:
+`observe` and `kyc` answer a `MoonPayStepResponse`, which says what the backend needs next:
 
 | `status` | Carries | The client then |
 | --- | --- | --- |
 | `TERMS` | `stage`, `documents` (at least one, all at `stage`) | sends `POST /fiat/terms`, then `observe` |
 | `SDK_AUTH` | `sessionToken`, `quoteInput` | runs the MoonPay connection check, then `observe` with credentials |
 | `KYC` | `fields`, `fieldErrors?` (each naming a field in `fields`) | shows the shared form, then sends `kyc` |
-| `PENDING` | `retryAfterMs` (at most 60 s) | sends the same request again after the delay |
+| `PENDING` | `retryAfterMs` (at most 60 s) | sends `observe` after the delay, never `kyc` again |
 | `READY` | `orderId`, `quoteInput` | mounts Apple Pay, then sends `order` after the charge |
-| `DONE` | `order`, the `GET /fiat/orders/:orderId` response | shows the shared order status |
 | `REFUSED` | `reason` (`NOT_ELIGIBLE`, `DOCUMENTS_REQUIRED`, `FINAL_REJECTION`, `CUSTOMER_MISMATCH`), `recovery: REQUOTE \| NONE` | exits the provider flow |
 
+`order` runs after the charge and answers a `MoonPayOrderResponse`:
+
+| `status` | Carries | The client then |
+| --- | --- | --- |
+| `DONE` | `order`, the `GET /fiat/orders/:orderId` response | shows the shared order status |
+| `PENDING` | `retryAfterMs` (at most 60 s) | sends the same `order` after the delay |
+| `REFUSED` | `reason` (`CUSTOMER_MISMATCH`, `WALLET_MISMATCH`, `UNRECORDABLE`), `recovery: NONE` | exits the provider flow |
+
+`MoonPayIntentResponseFor` maps each `kind` to its union, and `MoonPayIntentResponse` is both.
+
 A fault is a 4xx or 5xx with a `MoonPayErrorBody`: the shared `errorCode`, `errorMsg` and `reqId`,
 plus `reason` (`SESSION_BUDGET_SPENT`, `RATE_LIMITED`, `PROVIDER_UNAVAILABLE`, `IN_PROGRESS`,
-`IDEMPOTENCY_KEY_REUSED`, `INVALID_REQUEST`, `TRANSACTION_MISMATCH`, `WALLET_MISMATCH`) and `recovery`:
-`RETRY` (send the same request, with the same key), `REQUOTE`, or `NONE`. A field error is a `KYC`
+`INVALID_REQUEST`) and `recovery`:
+`RETRY` (send the same request again), `REQUOTE`, or `NONE`. A field error is a `KYC`
 response, not a fault. The zod schemas (`MoonPay*Schema`, `TermsDocumentSchema`, `FiatTerms*Schema`)
 are exported from the root only.
 

package/dist/{chunk-544S4IEU.mjs → chunk-LBYBZDOW.mjs}

@@ -1,5 +1,5 @@
 // package.json
-var version = "0.20.1";
+var version = "0.21.0";
 
 // src/table.ts
 var TABLE_VERSION = version;
@@ -514,4 +514,4 @@ export {
   tableEntry,
   isTerminal
 };
-//# sourceMappingURL=chunk-544S4IEU.mjs.map
+//# sourceMappingURL=chunk-LBYBZDOW.mjs.map

package/dist/chunk-N6GHUS2K.mjs

@@ -0,0 +1,44 @@
+// src/terms.ts
+var FIAT_TERMS_ENDPOINT = "POST /fiat/terms";
+var MOONPAY_TERMS = {
+  id: "MOONPAY_TERMS",
+  kind: "PROVIDER_TERMS",
+  stage: "CHECKOUT",
+  version: "2026-09-l2-kyc-sharing-v2",
+  contentDigest: "44e096af329262134fe6680659c9bd42014cbf5e96f064d67869173a4f7d822b",
+  links: [
+    { label: "MoonPay Terms of Use", url: "https://www.moonpay.com/legal/terms" },
+    { label: "MoonPay Privacy Policy", url: "https://www.moonpay.com/legal/privacy_policy" },
+    { label: "Persona Privacy Policy", url: "https://withpersona.com/legal/privacy-policy" }
+  ]
+};
+var PROVIDER_CHECKOUT_DOCUMENTS = {
+  MOONPAY: [MOONPAY_TERMS]
+};
+var funKycConsent = (contentDigest) => ({
+  id: "FUN_KYC_CONSENT",
+  kind: "FUN_KYC_COLLECTION",
+  stage: "KYC",
+  version: "fun-kyc-consent-2026-09-11",
+  contentDigest,
+  links: [{ label: "Fun.xyz Privacy Policy", url: "https://fun.xyz/privacy" }]
+});
+var FUN_KYC_CONSENT_DOCUMENTS = {
+  en: funKycConsent("da31f2467deb996476b131116508ea2a00220765e658a79abc6d2bd44337504a"),
+  es: funKycConsent("73753b70ad8d1b48dfdcda35e6028c3a7ada66c311a67a1d8f6fe13c76a32f3b"),
+  fr: funKycConsent("5ee82675984591dbf66337f31246179103c5624a189850943d400f9b85a84965"),
+  ja: funKycConsent("3f272da313f66601a20c3ca43c967aff4bb7f73488177f0a4ce94cbc78bafce2"),
+  ko: funKycConsent("aab7839bfba3f34aa47ca6b10647c2c8965c37d845494ef8f3067ca3e3821200"),
+  ru: funKycConsent("17168083ebcc4fd11ea80b08c3f230bdec03a1e7b89173a38819ae5533b0fc96"),
+  tr: funKycConsent("463040c3b58c922ecae2ae8262a78eb732bbcc5606c394723626378b3db2bbc3"),
+  zh: funKycConsent("7f76d850adaf69783c5d9365e51abb5446f4e5778c63eabbdb4784d72464f855")
+};
+var PUBLISHED_TERMS_DOCUMENTS = [MOONPAY_TERMS, ...Object.values(FUN_KYC_CONSENT_DOCUMENTS)];
+
+export {
+  FIAT_TERMS_ENDPOINT,
+  PROVIDER_CHECKOUT_DOCUMENTS,
+  FUN_KYC_CONSENT_DOCUMENTS,
+  PUBLISHED_TERMS_DOCUMENTS
+};
+//# sourceMappingURL=chunk-N6GHUS2K.mjs.map

package/dist/{chunk-UN3WTIMI.mjs → chunk-YOMQWXTD.mjs}

@@ -6,4 +6,4 @@ var MOONPAY_ENDPOINTS = {
 export {
   MOONPAY_ENDPOINTS
 };
-//# sourceMappingURL=chunk-UN3WTIMI.mjs.map
+//# sourceMappingURL=chunk-YOMQWXTD.mjs.map

package/dist/index.js

@@ -36,6 +36,7 @@ __export(index_exports, {
   FIELD_SPEC_TYPES: () => FIELD_SPEC_TYPES,
   FIXTURES: () => FIXTURES,
   FIXTURE_COVERAGE_GAPS: () => FIXTURE_COVERAGE_GAPS,
+  FUN_KYC_CONSENT_DOCUMENTS: () => FUN_KYC_CONSENT_DOCUMENTS,
   FailureReasonSchema: () => FailureReasonSchema,
   FeeLineSchema: () => FeeLineSchema,
   FiatAmountSchema: () => FiatAmountSchema,
@@ -60,6 +61,7 @@ __export(index_exports, {
   KYCProviderSchema: () => KYCProviderSchema,
   KYC_ACKNOWLEDGEMENT_FIELD_IDS: () => KYC_ACKNOWLEDGEMENT_FIELD_IDS,
   KycCaptureStateSchema: () => KycCaptureStateSchema,
+  KycFieldIdSchema: () => KycFieldIdSchema,
   KycInputRequiredStateSchema: () => KycInputRequiredStateSchema,
   KycNoActionRequiredStateSchema: () => KycNoActionRequiredStateSchema,
   KycSdkResultReportSchema: () => KycSdkResultReportSchema,
@@ -69,14 +71,18 @@ __export(index_exports, {
   MoonPayFaultSchema: () => MoonPayFaultSchema,
   MoonPayIntentRequestSchema: () => MoonPayIntentRequestSchema,
   MoonPayIntentResponseSchema: () => MoonPayIntentResponseSchema,
+  MoonPayOrderResponseSchema: () => MoonPayOrderResponseSchema,
   MoonPayQuoteInputSchema: () => MoonPayQuoteInputSchema,
   MoonPaySdkCredentialsSchema: () => MoonPaySdkCredentialsSchema,
+  MoonPayStepResponseSchema: () => MoonPayStepResponseSchema,
   OrderAwaitingConfirmationStateSchema: () => OrderAwaitingConfirmationStateSchema,
   OrderCreatedStateSchema: () => OrderCreatedStateSchema,
   OrderRefSchema: () => OrderRefSchema,
   OrderStatusSchema: () => OrderStatusSchema,
   OrderSummarySchema: () => OrderSummarySchema,
   PAYMENT_METHOD_CATEGORIES: () => PAYMENT_METHOD_CATEGORIES,
+  PROVIDER_CHECKOUT_DOCUMENTS: () => PROVIDER_CHECKOUT_DOCUMENTS,
+  PUBLISHED_TERMS_DOCUMENTS: () => PUBLISHED_TERMS_DOCUMENTS,
   PaymentCaptureStateSchema: () => PaymentCaptureStateSchema,
   PaymentInstructStateSchema: () => PaymentInstructStateSchema,
   PaymentSurfaceSchema: () => PaymentSurfaceSchema,
@@ -658,6 +664,7 @@ var $kycFieldId = import_zod.z.union([
   import_zod.z.enum(KYC_ACKNOWLEDGEMENT_FIELD_IDS),
   $questionnaireKycFieldId
 ]);
+var KycFieldIdSchema = $kycFieldId;
 var $clientExecutedDelivery = obj({
   channel: import_zod.z.literal("CLIENT_EXECUTED"),
   source: import_zod.z.literal("CURRENT_SESSION_INPUTS"),
@@ -971,7 +978,7 @@ var $nonBlank = import_zod.z.string().refine((value) => value.trim().length > 0,
 var $termsStage = import_zod.z.enum(["CHECKOUT", "KYC"]);
 var $termsDocument = obj({
   id: $nonBlank,
-  kind: import_zod.z.enum(["FUN_TERMS", "PROVIDER_TERMS", "FUN_KYC_COLLECTION", "PROVIDER_KYC_SHARING"]),
+  kind: import_zod.z.enum(["PROVIDER_TERMS", "FUN_KYC_COLLECTION", "PROVIDER_KYC_SHARING"]),
   stage: $termsStage,
   version: $nonBlank,
   contentDigest: $nonBlank,
@@ -979,10 +986,6 @@ var $termsDocument = obj({
 });
 var TermsDocumentSchema = $termsDocument;
 var hasUniqueIds = (ids) => new Set(ids).size === ids.length;
-var $termsDocuments = (stage) => import_zod.z.array($termsDocument).refine((documents) => hasUniqueIds(documents.map((document) => document.id)), "document ids must be unique").refine(
-  (documents) => stage === void 0 || documents.every((document) => document.stage === stage),
-  `every document must be at stage ${stage}`
-);
 var $termsAcceptance = obj({
   documentId: $nonBlank,
   version: $nonBlank,
@@ -1001,7 +1004,7 @@ var $termsErrorBody = obj({
   errorCode: $nonBlank,
   errorMsg: import_zod.z.string(),
   reqId: import_zod.z.string().optional(),
-  reason: import_zod.z.enum(["STALE_TERMS", "IN_PROGRESS", "IDEMPOTENCY_KEY_REUSED", "INVALID_REQUEST", "RATE_LIMITED", "PROVIDER_UNAVAILABLE"]),
+  reason: import_zod.z.enum(["STALE_TERMS", "IN_PROGRESS", "INVALID_REQUEST", "RATE_LIMITED", "PROVIDER_UNAVAILABLE"]),
   recovery: import_zod.z.enum(["RETRY", "REQUOTE", "NONE"])
 });
 var FiatTermsErrorBodySchema = $termsErrorBody;
@@ -1010,7 +1013,7 @@ var $providerBoundStepResponse = obj({
   provider: $provider,
   transitions: import_zod.z.array($transition),
   preparedPayment: $preparedPayment.optional(),
-  handoff: obj({ provider: $provider, terms: $termsDocuments("CHECKOUT") }).optional(),
+  handoff: obj({ provider: $provider }).optional(),
   routingSessionRef: import_zod.z.string().optional(),
   providerAuthToken: obj({
     clientSecret: import_zod.z.string(),
@@ -1064,7 +1067,7 @@ var $stepResponse = import_zod.z.union([$providerBoundStepResponse, $blockedStep
 var FiatStepResponseSchema = $stepResponse;
 
 // package.json
-var version = "0.20.1";
+var version = "0.21.0";
 
 // src/table.ts
 var TABLE_VERSION = version;
@@ -2632,6 +2635,40 @@ function assertAllFixtures() {
 
 // src/terms.ts
 var FIAT_TERMS_ENDPOINT = "POST /fiat/terms";
+var MOONPAY_TERMS = {
+  id: "MOONPAY_TERMS",
+  kind: "PROVIDER_TERMS",
+  stage: "CHECKOUT",
+  version: "2026-09-l2-kyc-sharing-v2",
+  contentDigest: "44e096af329262134fe6680659c9bd42014cbf5e96f064d67869173a4f7d822b",
+  links: [
+    { label: "MoonPay Terms of Use", url: "https://www.moonpay.com/legal/terms" },
+    { label: "MoonPay Privacy Policy", url: "https://www.moonpay.com/legal/privacy_policy" },
+    { label: "Persona Privacy Policy", url: "https://withpersona.com/legal/privacy-policy" }
+  ]
+};
+var PROVIDER_CHECKOUT_DOCUMENTS = {
+  MOONPAY: [MOONPAY_TERMS]
+};
+var funKycConsent = (contentDigest) => ({
+  id: "FUN_KYC_CONSENT",
+  kind: "FUN_KYC_COLLECTION",
+  stage: "KYC",
+  version: "fun-kyc-consent-2026-09-11",
+  contentDigest,
+  links: [{ label: "Fun.xyz Privacy Policy", url: "https://fun.xyz/privacy" }]
+});
+var FUN_KYC_CONSENT_DOCUMENTS = {
+  en: funKycConsent("da31f2467deb996476b131116508ea2a00220765e658a79abc6d2bd44337504a"),
+  es: funKycConsent("73753b70ad8d1b48dfdcda35e6028c3a7ada66c311a67a1d8f6fe13c76a32f3b"),
+  fr: funKycConsent("5ee82675984591dbf66337f31246179103c5624a189850943d400f9b85a84965"),
+  ja: funKycConsent("3f272da313f66601a20c3ca43c967aff4bb7f73488177f0a4ce94cbc78bafce2"),
+  ko: funKycConsent("aab7839bfba3f34aa47ca6b10647c2c8965c37d845494ef8f3067ca3e3821200"),
+  ru: funKycConsent("17168083ebcc4fd11ea80b08c3f230bdec03a1e7b89173a38819ae5533b0fc96"),
+  tr: funKycConsent("463040c3b58c922ecae2ae8262a78eb732bbcc5606c394723626378b3db2bbc3"),
+  zh: funKycConsent("7f76d850adaf69783c5d9365e51abb5446f4e5778c63eabbdb4784d72464f855")
+};
+var PUBLISHED_TERMS_DOCUMENTS = [MOONPAY_TERMS, ...Object.values(FUN_KYC_CONSENT_DOCUMENTS)];
 
 // src/providers/moonpay.ts
 var MOONPAY_ENDPOINTS = {
@@ -2659,7 +2696,7 @@ var $intentRequest = import_zod2.z.discriminatedUnion("kind", [
     kind: import_zod2.z.literal("kyc"),
     checkout: $checkout,
     credentials: $credentials,
-    values: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.string()).refine((values) => Object.keys(values).length > 0, "values must not be empty")
+    values: import_zod2.z.record(KycFieldIdSchema, import_zod2.z.string()).refine((values) => Object.keys(values).length > 0, "values must not be empty")
   }),
   obj2({ kind: import_zod2.z.literal("order"), orderId: $nonEmpty, transactionId: $nonEmpty })
 ]);
@@ -2672,18 +2709,19 @@ var $quoteInput = obj2({
   feeBehavior: import_zod2.z.literal("inclusive")
 });
 var MoonPayQuoteInputSchema = $quoteInput;
-var $refusal = import_zod2.z.enum(["NOT_ELIGIBLE", "DOCUMENTS_REQUIRED", "FINAL_REJECTION", "CUSTOMER_MISMATCH"]);
+var $stepRefusal = import_zod2.z.enum(["NOT_ELIGIBLE", "DOCUMENTS_REQUIRED", "FINAL_REJECTION", "CUSTOMER_MISMATCH"]);
+var $orderRefusal = import_zod2.z.enum(["CUSTOMER_MISMATCH", "WALLET_MISMATCH", "UNRECORDABLE"]);
 var $fieldError = obj2({ fieldId: $nonEmpty, message: $nonEmpty });
-var $intentStatus = import_zod2.z.discriminatedUnion("status", [
+var $pending = obj2({ status: import_zod2.z.literal("PENDING"), retryAfterMs: import_zod2.z.number().int().positive().max(6e4) });
+var $stepStatus = import_zod2.z.discriminatedUnion("status", [
   obj2({ status: import_zod2.z.literal("TERMS"), stage: import_zod2.z.enum(["CHECKOUT", "KYC"]), documents: import_zod2.z.array(TermsDocumentSchema).min(1) }),
   obj2({ status: import_zod2.z.literal("SDK_AUTH"), sessionToken: $nonEmpty, quoteInput: $quoteInput }),
   obj2({ status: import_zod2.z.literal("KYC"), fields: import_zod2.z.array(FormFieldSchema).min(1), fieldErrors: import_zod2.z.array($fieldError).min(1).optional() }),
-  obj2({ status: import_zod2.z.literal("PENDING"), retryAfterMs: import_zod2.z.number().int().positive().max(6e4) }),
+  $pending,
   obj2({ status: import_zod2.z.literal("READY"), orderId: $nonEmpty, quoteInput: $quoteInput }),
-  obj2({ status: import_zod2.z.literal("DONE"), order: FiatStepResponseSchema }),
-  obj2({ status: import_zod2.z.literal("REFUSED"), reason: $refusal, recovery: import_zod2.z.enum(["REQUOTE", "NONE"]) })
+  obj2({ status: import_zod2.z.literal("REFUSED"), reason: $stepRefusal, recovery: import_zod2.z.enum(["REQUOTE", "NONE"]) })
 ]);
-var $intentResponse = $intentStatus.superRefine((response, context) => {
+var $stepResponse2 = $stepStatus.superRefine((response, context) => {
   if (response.status === "TERMS") {
     if (!hasUniqueIds2(response.documents.map((document) => document.id))) {
       context.addIssue({ code: "custom", path: ["documents"], message: "document ids must be unique" });
@@ -2702,6 +2740,14 @@ var $intentResponse = $intentStatus.superRefine((response, context) => {
     }
   }
 });
+var MoonPayStepResponseSchema = $stepResponse2;
+var $orderResponse = import_zod2.z.discriminatedUnion("status", [
+  obj2({ status: import_zod2.z.literal("DONE"), order: FiatStepResponseSchema }),
+  $pending,
+  obj2({ status: import_zod2.z.literal("REFUSED"), reason: $orderRefusal, recovery: import_zod2.z.literal("NONE") })
+]);
+var MoonPayOrderResponseSchema = $orderResponse;
+var $intentResponse = import_zod2.z.union([$stepResponse2, $orderResponse]);
 var MoonPayIntentResponseSchema = $intentResponse;
 var $faultFields = {
   reason: import_zod2.z.enum([
@@ -2709,10 +2755,7 @@ var $faultFields = {
     "RATE_LIMITED",
     "PROVIDER_UNAVAILABLE",
     "IN_PROGRESS",
-    "IDEMPOTENCY_KEY_REUSED",
-    "INVALID_REQUEST",
-    "TRANSACTION_MISMATCH",
-    "WALLET_MISMATCH"
+    "INVALID_REQUEST"
   ]),
   recovery: import_zod2.z.enum(["RETRY", "REQUOTE", "NONE"])
 };

package/dist/index.mjs

@@ -12,13 +12,16 @@ import {
   tableEntry,
   unofferedEndpoints,
   unreachableStates
-} from "./chunk-544S4IEU.mjs";
+} from "./chunk-LBYBZDOW.mjs";
 import {
   MOONPAY_ENDPOINTS
-} from "./chunk-UN3WTIMI.mjs";
+} from "./chunk-YOMQWXTD.mjs";
 import {
-  FIAT_TERMS_ENDPOINT
-} from "./chunk-WRRCWAY2.mjs";
+  FIAT_TERMS_ENDPOINT,
+  FUN_KYC_CONSENT_DOCUMENTS,
+  PROVIDER_CHECKOUT_DOCUMENTS,
+  PUBLISHED_TERMS_DOCUMENTS
+} from "./chunk-N6GHUS2K.mjs";
 
 // src/codes.ts
 var US_STATE_CODES = [
@@ -545,6 +548,7 @@ var $kycFieldId = z.union([
   z.enum(KYC_ACKNOWLEDGEMENT_FIELD_IDS),
   $questionnaireKycFieldId
 ]);
+var KycFieldIdSchema = $kycFieldId;
 var $clientExecutedDelivery = obj({
   channel: z.literal("CLIENT_EXECUTED"),
   source: z.literal("CURRENT_SESSION_INPUTS"),
@@ -858,7 +862,7 @@ var $nonBlank = z.string().refine((value) => value.trim().length > 0, "must not
 var $termsStage = z.enum(["CHECKOUT", "KYC"]);
 var $termsDocument = obj({
   id: $nonBlank,
-  kind: z.enum(["FUN_TERMS", "PROVIDER_TERMS", "FUN_KYC_COLLECTION", "PROVIDER_KYC_SHARING"]),
+  kind: z.enum(["PROVIDER_TERMS", "FUN_KYC_COLLECTION", "PROVIDER_KYC_SHARING"]),
   stage: $termsStage,
   version: $nonBlank,
   contentDigest: $nonBlank,
@@ -866,10 +870,6 @@ var $termsDocument = obj({
 });
 var TermsDocumentSchema = $termsDocument;
 var hasUniqueIds = (ids) => new Set(ids).size === ids.length;
-var $termsDocuments = (stage) => z.array($termsDocument).refine((documents) => hasUniqueIds(documents.map((document) => document.id)), "document ids must be unique").refine(
-  (documents) => stage === void 0 || documents.every((document) => document.stage === stage),
-  `every document must be at stage ${stage}`
-);
 var $termsAcceptance = obj({
   documentId: $nonBlank,
   version: $nonBlank,
@@ -888,7 +888,7 @@ var $termsErrorBody = obj({
   errorCode: $nonBlank,
   errorMsg: z.string(),
   reqId: z.string().optional(),
-  reason: z.enum(["STALE_TERMS", "IN_PROGRESS", "IDEMPOTENCY_KEY_REUSED", "INVALID_REQUEST", "RATE_LIMITED", "PROVIDER_UNAVAILABLE"]),
+  reason: z.enum(["STALE_TERMS", "IN_PROGRESS", "INVALID_REQUEST", "RATE_LIMITED", "PROVIDER_UNAVAILABLE"]),
   recovery: z.enum(["RETRY", "REQUOTE", "NONE"])
 });
 var FiatTermsErrorBodySchema = $termsErrorBody;
@@ -897,7 +897,7 @@ var $providerBoundStepResponse = obj({
   provider: $provider,
   transitions: z.array($transition),
   preparedPayment: $preparedPayment.optional(),
-  handoff: obj({ provider: $provider, terms: $termsDocuments("CHECKOUT") }).optional(),
+  handoff: obj({ provider: $provider }).optional(),
   routingSessionRef: z.string().optional(),
   providerAuthToken: obj({
     clientSecret: z.string(),
@@ -2036,7 +2036,7 @@ var $intentRequest = z2.discriminatedUnion("kind", [
     kind: z2.literal("kyc"),
     checkout: $checkout,
     credentials: $credentials,
-    values: z2.record(z2.string(), z2.string()).refine((values) => Object.keys(values).length > 0, "values must not be empty")
+    values: z2.record(KycFieldIdSchema, z2.string()).refine((values) => Object.keys(values).length > 0, "values must not be empty")
   }),
   obj2({ kind: z2.literal("order"), orderId: $nonEmpty, transactionId: $nonEmpty })
 ]);
@@ -2049,18 +2049,19 @@ var $quoteInput = obj2({
   feeBehavior: z2.literal("inclusive")
 });
 var MoonPayQuoteInputSchema = $quoteInput;
-var $refusal = z2.enum(["NOT_ELIGIBLE", "DOCUMENTS_REQUIRED", "FINAL_REJECTION", "CUSTOMER_MISMATCH"]);
+var $stepRefusal = z2.enum(["NOT_ELIGIBLE", "DOCUMENTS_REQUIRED", "FINAL_REJECTION", "CUSTOMER_MISMATCH"]);
+var $orderRefusal = z2.enum(["CUSTOMER_MISMATCH", "WALLET_MISMATCH", "UNRECORDABLE"]);
 var $fieldError = obj2({ fieldId: $nonEmpty, message: $nonEmpty });
-var $intentStatus = z2.discriminatedUnion("status", [
+var $pending = obj2({ status: z2.literal("PENDING"), retryAfterMs: z2.number().int().positive().max(6e4) });
+var $stepStatus = z2.discriminatedUnion("status", [
   obj2({ status: z2.literal("TERMS"), stage: z2.enum(["CHECKOUT", "KYC"]), documents: z2.array(TermsDocumentSchema).min(1) }),
   obj2({ status: z2.literal("SDK_AUTH"), sessionToken: $nonEmpty, quoteInput: $quoteInput }),
   obj2({ status: z2.literal("KYC"), fields: z2.array(FormFieldSchema).min(1), fieldErrors: z2.array($fieldError).min(1).optional() }),
-  obj2({ status: z2.literal("PENDING"), retryAfterMs: z2.number().int().positive().max(6e4) }),
+  $pending,
   obj2({ status: z2.literal("READY"), orderId: $nonEmpty, quoteInput: $quoteInput }),
-  obj2({ status: z2.literal("DONE"), order: FiatStepResponseSchema }),
-  obj2({ status: z2.literal("REFUSED"), reason: $refusal, recovery: z2.enum(["REQUOTE", "NONE"]) })
+  obj2({ status: z2.literal("REFUSED"), reason: $stepRefusal, recovery: z2.enum(["REQUOTE", "NONE"]) })
 ]);
-var $intentResponse = $intentStatus.superRefine((response, context) => {
+var $stepResponse2 = $stepStatus.superRefine((response, context) => {
   if (response.status === "TERMS") {
     if (!hasUniqueIds2(response.documents.map((document) => document.id))) {
       context.addIssue({ code: "custom", path: ["documents"], message: "document ids must be unique" });
@@ -2079,6 +2080,14 @@ var $intentResponse = $intentStatus.superRefine((response, context) => {
     }
   }
 });
+var MoonPayStepResponseSchema = $stepResponse2;
+var $orderResponse = z2.discriminatedUnion("status", [
+  obj2({ status: z2.literal("DONE"), order: FiatStepResponseSchema }),
+  $pending,
+  obj2({ status: z2.literal("REFUSED"), reason: $orderRefusal, recovery: z2.literal("NONE") })
+]);
+var MoonPayOrderResponseSchema = $orderResponse;
+var $intentResponse = z2.union([$stepResponse2, $orderResponse]);
 var MoonPayIntentResponseSchema = $intentResponse;
 var $faultFields = {
   reason: z2.enum([
@@ -2086,10 +2095,7 @@ var $faultFields = {
     "RATE_LIMITED",
     "PROVIDER_UNAVAILABLE",
     "IN_PROGRESS",
-    "IDEMPOTENCY_KEY_REUSED",
-    "INVALID_REQUEST",
-    "TRANSACTION_MISMATCH",
-    "WALLET_MISMATCH"
+    "INVALID_REQUEST"
   ]),
   recovery: z2.enum(["RETRY", "REQUOTE", "NONE"])
 };
@@ -2114,6 +2120,7 @@ export {
   FIELD_SPEC_TYPES,
   FIXTURES,
   FIXTURE_COVERAGE_GAPS,
+  FUN_KYC_CONSENT_DOCUMENTS,
   FailureReasonSchema,
   FeeLineSchema,
   FiatAmountSchema,
@@ -2138,6 +2145,7 @@ export {
   KYCProviderSchema,
   KYC_ACKNOWLEDGEMENT_FIELD_IDS,
   KycCaptureStateSchema,
+  KycFieldIdSchema,
   KycInputRequiredStateSchema,
   KycNoActionRequiredStateSchema,
   KycSdkResultReportSchema,
@@ -2147,14 +2155,18 @@ export {
   MoonPayFaultSchema,
   MoonPayIntentRequestSchema,
   MoonPayIntentResponseSchema,
+  MoonPayOrderResponseSchema,
   MoonPayQuoteInputSchema,
   MoonPaySdkCredentialsSchema,
+  MoonPayStepResponseSchema,
   OrderAwaitingConfirmationStateSchema,
   OrderCreatedStateSchema,
   OrderRefSchema,
   OrderStatusSchema,
   OrderSummarySchema,
   PAYMENT_METHOD_CATEGORIES,
+  PROVIDER_CHECKOUT_DOCUMENTS,
+  PUBLISHED_TERMS_DOCUMENTS,
   PaymentCaptureStateSchema,
   PaymentInstructStateSchema,
   PaymentSurfaceSchema,

package/dist/providers/moonpay.d.ts

@@ -2,12 +2,13 @@
  * The MoonPay provider-owned flow: one route, `POST /fiat/providers/moonpay/intent`.
  *
  * Each request carries evidence or a user action (`kind`), and each response says what the backend
- * needs next (`status`). The client repeats until `DONE` or `REFUSED`. Terms and consents go through
+ * needs next (`status`). `observe` and `kyc` answer a `MoonPayStepResponse`, and `order` answers a
+ * `MoonPayOrderResponse` (`MoonPayIntentResponseFor`). Terms and consents go through
  * the platform `POST /fiat/terms` (`./terms`). Identity and the deposit wallet always come from the
  * verified partner assertion, never from a request body.
  *
- * `kyc` and `order` require an `Idempotency-Key` header; `observe` ignores it. A repeated key skips
- * the effect and still returns the current response.
+ * A retry sends the same request. Each write is idempotent on data the request carries, and every
+ * call, a retry too, returns the current response.
  *
  * A fault is a 4xx/5xx whose body is `MoonPayErrorBody`. Anything the user can act on is a 200
  * `MoonPayIntentResponse`.
@@ -17,7 +18,7 @@
  */
 import type { FiatCurrencyCode } from '../codes';
 import type { TermsDocument, TermsStage } from '../terms';
-import type { FiatAmount, FiatStepResponse, FormField } from '../types';
+import type { FiatAmount, FiatStepResponse, FormField, KycFieldId } from '../types';
 export declare const MOONPAY_ENDPOINTS: {
     readonly intent: "POST /fiat/providers/moonpay/intent";
 };
@@ -49,12 +50,12 @@ export type MoonPayIntentRequest =
     checkout: MoonPayCheckout;
     credentials?: MoonPaySdkCredentials;
 }
-/** Only after a `KYC` response. `values` is keyed by field id; there is no form id. */
+/** Only after a `KYC` response. `values` is keyed by the ids of that response's fields; there is no form id. */
  | {
     kind: 'kyc';
     checkout: MoonPayCheckout;
     credentials: MoonPaySdkCredentials;
-    values: Record<string, string>;
+    values: Partial<Record<KycFieldId, string>>;
 }
 /** After the Apple Pay sheet. `transactionId` is from the Apple Pay completion event. */
  | {
@@ -87,13 +88,21 @@ export interface MoonPayQuoteInput {
     };
     feeBehavior: 'inclusive';
 }
-export type MoonPayRefusal = 'NOT_ELIGIBLE' | 'DOCUMENTS_REQUIRED' | 'FINAL_REJECTION' | 'CUSTOMER_MISMATCH';
+/** `REQUOTE` for `NOT_ELIGIBLE` and `DOCUMENTS_REQUIRED`, `NONE` for the others. */
+export type MoonPayStepRefusal = 'NOT_ELIGIBLE' | 'DOCUMENTS_REQUIRED' | 'FINAL_REJECTION' | 'CUSTOMER_MISMATCH';
+/**
+ * After a charge, always with `recovery: NONE`. `CUSTOMER_MISMATCH`: the transaction's customer is
+ * not bound to this buyer. `WALLET_MISMATCH`: the transaction pays another wallet than the
+ * assertion's. `UNRECORDABLE`: a charge no retry can record, held for refund review.
+ */
+export type MoonPayOrderRefusal = 'CUSTOMER_MISMATCH' | 'WALLET_MISMATCH' | 'UNRECORDABLE';
 /** A reason on one field of a `KYC` response. `fieldId` names a field in that response. */
 export interface MoonPayFieldError {
     fieldId: string;
     message: string;
 }
-export type MoonPayIntentResponse = 
+/** The answer to `observe` and `kyc`. */
+export type MoonPayStepResponse = 
 /** Show `documents` (every one at `stage`), send `POST /fiat/terms`, then `observe`. */
 {
     status: 'TERMS';
@@ -112,7 +121,7 @@ export type MoonPayIntentResponse =
     fields: FormField[];
     fieldErrors?: MoonPayFieldError[];
 }
-/** Send the same request again after the delay. */
+/** Send `observe` after the delay. Never `kyc` again: its write is done. */
  | {
     status: 'PENDING';
     retryAfterMs: number;
@@ -123,29 +132,45 @@ export type MoonPayIntentResponse =
     orderId: string;
     quoteInput: MoonPayQuoteInput;
 }
-/** The `GET /fiat/orders/:orderId` response; the shared order screen renders it. */
+/** Exit the provider flow. `REQUOTE` goes back to `POST /fiat/quote`; `NONE` ends the flow. */
  | {
+    status: 'REFUSED';
+    reason: MoonPayStepRefusal;
+    recovery: 'REQUOTE' | 'NONE';
+};
+/** The answer to `order`, which runs after the charge. */
+export type MoonPayOrderResponse = 
+/** The `GET /fiat/orders/:orderId` response; the shared order screen renders it. */
+{
     status: 'DONE';
     order: FiatStepResponse;
 }
-/** Exit the provider flow. `REQUOTE` goes back to `POST /fiat/quote`; `NONE` ends the flow. */
+/** MoonPay does not show the transaction yet. Send the same `order` after the delay. */
+ | {
+    status: 'PENDING';
+    retryAfterMs: number;
+}
+/** Exit the provider flow. A requote after a charge would start a second payment. */
  | {
     status: 'REFUSED';
-    reason: MoonPayRefusal;
-    recovery: 'REQUOTE' | 'NONE';
+    reason: MoonPayOrderRefusal;
+    recovery: 'NONE';
+};
+export type MoonPayIntentResponseFor = {
+    observe: MoonPayStepResponse;
+    kyc: MoonPayStepResponse;
+    order: MoonPayOrderResponse;
 };
+export type MoonPayIntentResponse = MoonPayStepResponse | MoonPayOrderResponse;
 export type MoonPayIntentStatus = MoonPayIntentResponse['status'];
-/** `RETRY` sends the same request again, with the same key. `REQUOTE` goes back to `POST /fiat/quote`. `NONE` ends the flow. */
+/** `RETRY` sends the same request again. `REQUOTE` goes back to `POST /fiat/quote`. `NONE` ends the flow. */
 export type MoonPayRecovery = 'RETRY' | 'REQUOTE' | 'NONE';
 /**
  * `SESSION_BUDGET_SPENT`: the per-login SDK session mint budget (429). `RATE_LIMITED`: the kind's
- * request budget (429). `PROVIDER_UNAVAILABLE`: MoonPay or Sumsub is down, or a charge cannot be
- * recorded. `IN_PROGRESS`: the same key is still running (409). `IDEMPOTENCY_KEY_REUSED`: the same
- * key with a different body (422). `INVALID_REQUEST`: a bad body or a missing key (400).
- * `TRANSACTION_MISMATCH`: the transaction is not this buyer's (400). `WALLET_MISMATCH`: the
- * transaction pays another wallet.
+ * request budget (429). `PROVIDER_UNAVAILABLE`: MoonPay or Sumsub is down. `IN_PROGRESS`: a `kyc`
+ * for this buyer is still running (409). `INVALID_REQUEST`: a bad body (400).
  */
-export type MoonPayFaultReason = 'SESSION_BUDGET_SPENT' | 'RATE_LIMITED' | 'PROVIDER_UNAVAILABLE' | 'IN_PROGRESS' | 'IDEMPOTENCY_KEY_REUSED' | 'INVALID_REQUEST' | 'TRANSACTION_MISMATCH' | 'WALLET_MISMATCH';
+export type MoonPayFaultReason = 'SESSION_BUDGET_SPENT' | 'RATE_LIMITED' | 'PROVIDER_UNAVAILABLE' | 'IN_PROGRESS' | 'INVALID_REQUEST';
 /** The fields a MoonPay fault adds to the shared error body. */
 export interface MoonPayFault {
     reason: MoonPayFaultReason;

package/dist/providers/moonpay.mjs

@@ -1,6 +1,6 @@
 import {
   MOONPAY_ENDPOINTS
-} from "../chunk-UN3WTIMI.mjs";
+} from "../chunk-YOMQWXTD.mjs";
 export {
   MOONPAY_ENDPOINTS
 };

package/dist/providers/moonpay.schemas.d.ts

@@ -3,11 +3,13 @@
  * the package root, never from `./moonpay`, so the production entry stays free of zod.
  */
 import { z } from 'zod';
-import type { MoonPayCheckout, MoonPayErrorBody, MoonPayFault, MoonPayIntentRequest, MoonPayIntentResponse, MoonPayQuoteInput, MoonPaySdkCredentials } from './moonpay';
+import type { MoonPayCheckout, MoonPayErrorBody, MoonPayFault, MoonPayIntentRequest, MoonPayIntentResponse, MoonPayOrderResponse, MoonPayQuoteInput, MoonPaySdkCredentials, MoonPayStepResponse } from './moonpay';
 export declare const MoonPayCheckoutSchema: z.ZodType<MoonPayCheckout>;
 export declare const MoonPaySdkCredentialsSchema: z.ZodType<MoonPaySdkCredentials>;
 export declare const MoonPayIntentRequestSchema: z.ZodType<MoonPayIntentRequest>;
 export declare const MoonPayQuoteInputSchema: z.ZodType<MoonPayQuoteInput>;
+export declare const MoonPayStepResponseSchema: z.ZodType<MoonPayStepResponse>;
+export declare const MoonPayOrderResponseSchema: z.ZodType<MoonPayOrderResponse>;
 export declare const MoonPayIntentResponseSchema: z.ZodType<MoonPayIntentResponse>;
 export declare const MoonPayFaultSchema: z.ZodType<MoonPayFault>;
 export declare const MoonPayErrorBodySchema: z.ZodType<MoonPayErrorBody>;

package/dist/schemas.d.ts

@@ -28,7 +28,7 @@
  */
 import { z } from 'zod';
 import type { UsStateCode } from './codes';
-import type { BlockedReason, CryptoAmount, FailureReason, FeeLine, FiatAmount, FiatEndpoint, FiatProvider, FiatStepResponse, FieldSpec, FlowState, FormDescriptor, FormField, FormFieldType, InstructionField, Instructions, Instrument, JsonValue, KYCProvider, OrderRef, OrderStatus, OrderSummary, PollSpec, PreparedPayment, PaymentSurface, Quote, QuoteLimitRange, QuoteLimits, Recovery, Refund, ReportSpec, SelectOption, StatusHistoryEntry, Surface, PreferredIdentityDocument, ClientExecutedDelivery, KycSdkResultReport, SurfaceKind, SurfaceProvider, TermsAcceptance, Transition, TransitionInputs, TransitionParams, Tx } from './types';
+import type { BlockedReason, CryptoAmount, FailureReason, FeeLine, FiatAmount, FiatEndpoint, FiatProvider, FiatStepResponse, FieldSpec, FlowState, FormDescriptor, FormField, FormFieldType, InstructionField, Instructions, Instrument, JsonValue, KYCProvider, OrderRef, OrderStatus, OrderSummary, PollSpec, PreparedPayment, PaymentSurface, Quote, QuoteLimitRange, QuoteLimits, Recovery, Refund, ReportSpec, SelectOption, StatusHistoryEntry, Surface, PreferredIdentityDocument, KycFieldId, ClientExecutedDelivery, KycSdkResultReport, SurfaceKind, SurfaceProvider, TermsAcceptance, Transition, TransitionInputs, TransitionParams, Tx } from './types';
 import type { FiatTermsErrorBody, FiatTermsRequest, FiatTermsResponse, TermsDocument, TermsDocumentAcceptance } from './terms';
 export declare const JsonSchema: z.ZodType<JsonValue>;
 export declare const HTTP_VERBS: readonly ["GET", "POST"];
@@ -58,6 +58,7 @@ export declare const SurfaceKindSchema: z.ZodType<SurfaceKind>;
 export declare const PreferredIdentityDocumentSchema: z.ZodType<PreferredIdentityDocument>;
 export declare const STANDARD_KYC_FIELD_IDS: readonly ["LEGAL_FIRST_NAME", "LEGAL_MIDDLE_NAME", "LEGAL_LAST_NAME", "DATE_OF_BIRTH", "COUNTRY_OF_BIRTH", "CITY_OF_BIRTH", "NATIONALITY", "EMAIL_ADDRESS", "EMAIL_OWNERSHIP_VERIFICATION", "PHONE_NUMBER", "PHONE_OWNERSHIP_VERIFICATION", "RESIDENTIAL_ADDRESS_LINE_1", "RESIDENTIAL_ADDRESS_LINE_2", "RESIDENTIAL_ADDRESS_CITY", "RESIDENTIAL_ADDRESS_REGION", "RESIDENTIAL_ADDRESS_POSTAL_CODE", "RESIDENTIAL_ADDRESS_COUNTRY", "TAX_IDENTIFIER", "US_SSN_LAST_FOUR", "TAX_RESIDENCE_COUNTRY", "EMPLOYMENT_STATUS", "OCCUPATION_INDUSTRY", "OCCUPATION_TITLE", "SOURCE_OF_FUNDS_DECLARATION", "SOURCE_OF_INCOME_DECLARATION", "SOURCE_OF_WEALTH_DECLARATION", "PURPOSE_OF_SERVICE", "PURPOSE_OF_TRANSACTION", "CUSTOMER_CATEGORY"];
 export declare const KYC_ACKNOWLEDGEMENT_FIELD_IDS: readonly ["RISK_ACKNOWLEDGEMENT", "COOLING_OFF_ACKNOWLEDGEMENT", "TERMS_ACCEPTANCE"];
+export declare const KycFieldIdSchema: z.ZodType<KycFieldId>;
 export declare const ClientExecutedDeliverySchema: z.ZodType<ClientExecutedDelivery>;
 export declare const SurfaceSchema: z.ZodType<Surface>;
 export declare const PaymentSurfaceSchema: z.ZodType<PaymentSurface>;

package/dist/table.js

@@ -36,7 +36,7 @@ __export(table_exports, {
 module.exports = __toCommonJS(table_exports);
 
 // package.json
-var version = "0.20.1";
+var version = "0.21.0";
 
 // src/table.ts
 var TABLE_VERSION = version;

package/dist/table.mjs

@@ -11,7 +11,7 @@ import {
   tableEntry,
   unofferedEndpoints,
   unreachableStates
-} from "./chunk-544S4IEU.mjs";
+} from "./chunk-LBYBZDOW.mjs";
 export {
   DOCUMENTED_ENDPOINTS,
   STATE_KEYS,

package/dist/terms.d.ts

@@ -1,17 +1,16 @@
 /**
  * The platform terms route: `POST /fiat/terms`, shared by every provider.
  *
- * A checkout shows the user documents to accept. `CHECKOUT` documents arrive in `handoff.terms` on
- * a `QUOTE`; `KYC` documents arrive in a provider flow's `TERMS` response. The user's Continue tap
- * is the acceptance, and the client records it here, with an `Idempotency-Key`, before the next
- * provider call.
+ * A checkout shows the user documents to accept. `CHECKOUT` documents are the constants below;
+ * `KYC` documents arrive in a provider flow's `TERMS` response. The user's Continue tap is the
+ * acceptance, and the client records it here before the next provider call. A repeat writes nothing.
  *
  * Zero runtime dependencies, so production React Native code can import it. The zod schemas are
  * exported from the package root.
  */
 import type { FiatProvider } from './types';
 export declare const FIAT_TERMS_ENDPOINT: "POST /fiat/terms";
-export type TermsDocumentKind = 'FUN_TERMS' | 'PROVIDER_TERMS' | 'FUN_KYC_COLLECTION' | 'PROVIDER_KYC_SHARING';
+export type TermsDocumentKind = 'PROVIDER_TERMS' | 'FUN_KYC_COLLECTION' | 'PROVIDER_KYC_SHARING';
 /** `CHECKOUT` documents gate the provider session; `KYC` documents gate the first KYC write. */
 export type TermsStage = 'CHECKOUT' | 'KYC';
 export interface TermsDocument {
@@ -45,14 +44,13 @@ export interface FiatTermsResponse {
     recorded: string[];
 }
 /**
- * `STALE_TERMS`: a version, digest, or `acceptedAt` the backend no longer accepts; the client
- * fetches the documents again. `IN_PROGRESS`: the same key is still running (409).
- * `IDEMPOTENCY_KEY_REUSED`: the same key with a different body (422). `INVALID_REQUEST`: a bad body
- * or a missing key (400). `RATE_LIMITED`: the per-login terms budget is spent (429).
- * `PROVIDER_UNAVAILABLE`: the KYC service or a store is down (503); nothing is recorded, so retry.
+ * `STALE_TERMS`: an unpublished version, a wrong digest, or an `acceptedAt` older than 5 minutes
+ * (400). `IN_PROGRESS`: the same request is still running (409). `INVALID_REQUEST`: a bad body (400).
+ * `RATE_LIMITED`: the per-login terms budget is spent (429). `PROVIDER_UNAVAILABLE`: the KYC service
+ * or a store is down (503); nothing is recorded, so retry.
  */
-export type FiatTermsFaultReason = 'STALE_TERMS' | 'IN_PROGRESS' | 'IDEMPOTENCY_KEY_REUSED' | 'INVALID_REQUEST' | 'RATE_LIMITED' | 'PROVIDER_UNAVAILABLE';
-/** `RETRY` sends the same request, with the same key. `REQUOTE` goes back to `POST /fiat/quote`. `NONE` ends the flow. */
+export type FiatTermsFaultReason = 'STALE_TERMS' | 'IN_PROGRESS' | 'INVALID_REQUEST' | 'RATE_LIMITED' | 'PROVIDER_UNAVAILABLE';
+/** `RETRY` sends the same request again. `REQUOTE` goes back to `POST /fiat/quote`. `NONE` ends the flow. */
 export type FiatTermsRecovery = 'RETRY' | 'REQUOTE' | 'NONE';
 /** The 4xx/5xx body of `POST /fiat/terms`: the shared error body plus `reason` and `recovery`. */
 export interface FiatTermsErrorBody {
@@ -62,4 +60,14 @@ export interface FiatTermsErrorBody {
     reason: FiatTermsFaultReason;
     recovery: FiatTermsRecovery;
 }
+/** Each provider's current `CHECKOUT` documents, shown next to Continue on the amount screen. */
+export declare const PROVIDER_CHECKOUT_DOCUMENTS: Readonly<Partial<Record<FiatProvider, readonly TermsDocument[]>>>;
+export type FunKycConsentLocale = 'en' | 'es' | 'fr' | 'ja' | 'ko' | 'ru' | 'tr' | 'zh';
+/** Fun's KYC consent, one digest per locale the KYC intro screen shows. It counts under any provider. */
+export declare const FUN_KYC_CONSENT_DOCUMENTS: Readonly<Record<FunKycConsentLocale, TermsDocument>>;
+/**
+ * Every version and locale ever published. Append a new version here and keep the old one: the
+ * backend accepts any entry, so a client that ships an older version can still check out.
+ */
+export declare const PUBLISHED_TERMS_DOCUMENTS: readonly TermsDocument[];
 //# sourceMappingURL=terms.d.ts.map

package/dist/terms.js

@@ -20,8 +20,45 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/terms.ts
 var terms_exports = {};
 __export(terms_exports, {
-  FIAT_TERMS_ENDPOINT: () => FIAT_TERMS_ENDPOINT
+  FIAT_TERMS_ENDPOINT: () => FIAT_TERMS_ENDPOINT,
+  FUN_KYC_CONSENT_DOCUMENTS: () => FUN_KYC_CONSENT_DOCUMENTS,
+  PROVIDER_CHECKOUT_DOCUMENTS: () => PROVIDER_CHECKOUT_DOCUMENTS,
+  PUBLISHED_TERMS_DOCUMENTS: () => PUBLISHED_TERMS_DOCUMENTS
 });
 module.exports = __toCommonJS(terms_exports);
 var FIAT_TERMS_ENDPOINT = "POST /fiat/terms";
+var MOONPAY_TERMS = {
+  id: "MOONPAY_TERMS",
+  kind: "PROVIDER_TERMS",
+  stage: "CHECKOUT",
+  version: "2026-09-l2-kyc-sharing-v2",
+  contentDigest: "44e096af329262134fe6680659c9bd42014cbf5e96f064d67869173a4f7d822b",
+  links: [
+    { label: "MoonPay Terms of Use", url: "https://www.moonpay.com/legal/terms" },
+    { label: "MoonPay Privacy Policy", url: "https://www.moonpay.com/legal/privacy_policy" },
+    { label: "Persona Privacy Policy", url: "https://withpersona.com/legal/privacy-policy" }
+  ]
+};
+var PROVIDER_CHECKOUT_DOCUMENTS = {
+  MOONPAY: [MOONPAY_TERMS]
+};
+var funKycConsent = (contentDigest) => ({
+  id: "FUN_KYC_CONSENT",
+  kind: "FUN_KYC_COLLECTION",
+  stage: "KYC",
+  version: "fun-kyc-consent-2026-09-11",
+  contentDigest,
+  links: [{ label: "Fun.xyz Privacy Policy", url: "https://fun.xyz/privacy" }]
+});
+var FUN_KYC_CONSENT_DOCUMENTS = {
+  en: funKycConsent("da31f2467deb996476b131116508ea2a00220765e658a79abc6d2bd44337504a"),
+  es: funKycConsent("73753b70ad8d1b48dfdcda35e6028c3a7ada66c311a67a1d8f6fe13c76a32f3b"),
+  fr: funKycConsent("5ee82675984591dbf66337f31246179103c5624a189850943d400f9b85a84965"),
+  ja: funKycConsent("3f272da313f66601a20c3ca43c967aff4bb7f73488177f0a4ce94cbc78bafce2"),
+  ko: funKycConsent("aab7839bfba3f34aa47ca6b10647c2c8965c37d845494ef8f3067ca3e3821200"),
+  ru: funKycConsent("17168083ebcc4fd11ea80b08c3f230bdec03a1e7b89173a38819ae5533b0fc96"),
+  tr: funKycConsent("463040c3b58c922ecae2ae8262a78eb732bbcc5606c394723626378b3db2bbc3"),
+  zh: funKycConsent("7f76d850adaf69783c5d9365e51abb5446f4e5778c63eabbdb4784d72464f855")
+};
+var PUBLISHED_TERMS_DOCUMENTS = [MOONPAY_TERMS, ...Object.values(FUN_KYC_CONSENT_DOCUMENTS)];
 //# sourceMappingURL=terms.js.map

package/dist/terms.mjs

@@ -1,7 +1,13 @@
 import {
-  FIAT_TERMS_ENDPOINT
-} from "./chunk-WRRCWAY2.mjs";
+  FIAT_TERMS_ENDPOINT,
+  FUN_KYC_CONSENT_DOCUMENTS,
+  PROVIDER_CHECKOUT_DOCUMENTS,
+  PUBLISHED_TERMS_DOCUMENTS
+} from "./chunk-N6GHUS2K.mjs";
 export {
-  FIAT_TERMS_ENDPOINT
+  FIAT_TERMS_ENDPOINT,
+  FUN_KYC_CONSENT_DOCUMENTS,
+  PROVIDER_CHECKOUT_DOCUMENTS,
+  PUBLISHED_TERMS_DOCUMENTS
 };
 //# sourceMappingURL=terms.mjs.map

package/dist/types.d.ts

@@ -19,7 +19,6 @@
  *  - terminality comes from the table (`src/table.ts`), never from `transitions.length`
  */
 import type { FiatCurrencyCode, PaymentMethodCategory } from './codes';
-import type { TermsDocument } from './terms';
 /**
  * JSON value. `params` carry these — opaque literals the client spreads verbatim.
  * Named `JsonValue` rather than `Json` because this package's surface is re-exported wholesale;
@@ -722,11 +721,6 @@ export type FiatStepResponse = (FiatStepResponseBase & {
      */
     handoff?: {
         provider: FiatProvider;
-        /**
-         * The `CHECKOUT` documents this login has not accepted at the current version, shown next to
-         * Continue and recorded with `POST /fiat/terms` on the tap. Empty for a returning buyer.
-         */
-        terms: TermsDocument[];
     };
 });
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fun-xyz/fiat-contract",
-  "version": "0.20.1",
+  "version": "0.21.0",
   "description": "Published conformance contract for Fun's headless fiat onramp: FlowState/Transition types, zod schemas, the transition table as data, recorded fixtures, assertion helpers.",
   "license": "MIT",
   "repository": {

package/dist/chunk-WRRCWAY2.mjs

@@ -1,7 +0,0 @@
-// src/terms.ts
-var FIAT_TERMS_ENDPOINT = "POST /fiat/terms";
-
-export {
-  FIAT_TERMS_ENDPOINT
-};
-//# sourceMappingURL=chunk-WRRCWAY2.mjs.map